What is the CVSS score of CVE-2026-11262?

CVE-2026-11262 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-11262?

Google Chrome versions prior to 149.0.7827.53 contain a critical remote code execution vulnerability in the TabStrip component that can be triggered when employees visit specially crafted websites.. A patch is available.

How to fix or mitigate CVE-2026-11262?

Within 24 hours: Issue security alert to all users and verify update capability across the organization; Within 7 days: Deploy Google Chrome 149.0.7827.53 or later to all managed systems; Within 30 days: Confirm 100% compliance with the minimum version requirement through patch verification scans and implement automated update enforcement.

Google Chrome CVE-2026-11262

EUVD-2026-34723 HIGH

Use After Free (CWE-416)

2026-06-05 chrome-cve-admin@google.com

GHSA-4q83-9x32-m447

RCE Denial Of Service Google Use After Free Memory Corruption

High

Disputed · 8.8 Vendor: google

Severity by source

Sources disagree (Low–High)

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 03:17 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 05, 2026 - 00:17 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in TabStrip in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Remote code execution in Google Chrome versions prior to 149.0.7827.53 stems from a use-after-free flaw in the TabStrip component, enabling a remote attacker who lures a victim to a crafted HTML page to corrupt memory and execute arbitrary code within the renderer context. Google rates the underlying Chromium severity as Low, but the CVSS base score of 8.8 reflects the potential impact when chained with a sandbox escape. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

TabStrip is the Chrome UI component that manages browser tab state, lifecycle, and rendering within the browser process boundary. CWE-416 (Use After Free) means an object reference is retained and dereferenced after the underlying memory has been freed, typically due to mismanaged lifetimes during asynchronous tab events or DOM-driven state transitions. Attacker-controlled HTML/JavaScript can groom the heap to reclaim the freed allocation with controlled data, converting the dangling pointer into a type confusion or arbitrary read/write primitive that leads to code execution in the renderer process. Chromium UAFs in UI-adjacent components historically require a separate sandbox escape to reach full host compromise.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - update via the Stable channel auto-updater or by visiting chrome://settings/help and relaunching, per https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Enterprises managing Chrome via group policy should push the 149.0.7827.53 (or later) MSI/PKG bundles and force a relaunch within the standard 72-hour patch window. No vendor-supplied workaround exists; as compensating controls until patching completes, restrict browsing of untrusted sites through enterprise web filtering or isolation (browser isolation services / RBI), and enable Site Isolation (default in modern Chrome) to keep cross-origin renderer compromise contained - note that isolation adds memory overhead per process. Downstream Chromium browsers must apply their vendor's equivalent update.